summaryrefslogtreecommitdiff
path: root/man
diff options
context:
space:
mode:
Diffstat (limited to 'man')
-rw-r--r--man/crypttab.xml11
-rw-r--r--man/machinectl.xml2
-rw-r--r--man/sd_journal_stream_fd.xml2
-rw-r--r--man/systemctl.xml2
-rw-r--r--man/systemd-escape.xml13
-rw-r--r--man/systemd-machine-id-setup.xml4
-rw-r--r--man/systemd-socket-activate.xml2
-rw-r--r--man/systemd-system.conf.xml2
-rw-r--r--man/systemd.exec.xml107
-rw-r--r--man/systemd.offline-updates.xml2
-rw-r--r--man/systemd.target.xml2
-rw-r--r--man/tmpfiles.d.xml2
12 files changed, 83 insertions, 68 deletions
diff --git a/man/crypttab.xml b/man/crypttab.xml
index 4b8d4aa3d6..17976f3704 100644
--- a/man/crypttab.xml
+++ b/man/crypttab.xml
@@ -327,6 +327,17 @@
</varlistentry>
<varlistentry>
+ <term><option>tcrypt-veracrypt</option></term>
+
+ <listitem><para>Check for a VeraCrypt volume. VeraCrypt is a fork of
+ TrueCrypt that is mostly compatible, but uses different, stronger key
+ derivation algorithms that cannot be detected without this flag.
+ Enabling this option could substantially slow down unlocking, because
+ VeraCrypt's key derivation takes much longer than TrueCrypt's. This
+ option implies <option>tcrypt</option>.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
<term><option>timeout=</option></term>
<listitem><para>Specifies the timeout for querying for a
diff --git a/man/machinectl.xml b/man/machinectl.xml
index 0d57c01765..5a6ec294d2 100644
--- a/man/machinectl.xml
+++ b/man/machinectl.xml
@@ -188,7 +188,7 @@
<listitem><para>When used with the <command>shell</command> command, chooses the user ID to
open the interactive shell session as. If the argument to the <command>shell</command>
- command also specifies an user name, this option is ignored. If the name is not specified
+ command also specifies a user name, this option is ignored. If the name is not specified
in either way, <literal>root</literal> will be used by default. Note that this switch is
not supported for the <command>login</command> command (see below).</para></listitem>
</varlistentry>
diff --git a/man/sd_journal_stream_fd.xml b/man/sd_journal_stream_fd.xml
index 226298ae1b..db88eba1bc 100644
--- a/man/sd_journal_stream_fd.xml
+++ b/man/sd_journal_stream_fd.xml
@@ -104,7 +104,7 @@
<refsect1>
<title>Notes</title>
- <para>Function <function>sd_journal_stream_fd()</function> is thread-safe and may be be called
+ <para>Function <function>sd_journal_stream_fd()</function> is thread-safe and may be called
from multiple threads. All calls will return the same file descriptor, although temporarily
multiple file descriptors may be open.</para>
diff --git a/man/systemctl.xml b/man/systemctl.xml
index 225eb06d8b..ae3296d132 100644
--- a/man/systemctl.xml
+++ b/man/systemctl.xml
@@ -1265,7 +1265,7 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
<literal>foo.service.d/</literal> with all their contained files are removed, both below the persistent and
runtime configuration directories (i.e. below <filename>/etc/systemd/system</filename> and
<filename>/run/systemd/system</filename>); if the unit file has a vendor-supplied version (i.e. a unit file
- located below <filename>/usr</filename>) any matching peristent or runtime unit file that overrides it is
+ located below <filename>/usr</filename>) any matching persistent or runtime unit file that overrides it is
removed, too. Note that if a unit file has no vendor-supplied version (i.e. is only defined below
<filename>/etc/systemd/system</filename> or <filename>/run/systemd/system</filename>, but not in a unit
file stored below <filename>/usr</filename>), then it is not removed. Also, if a unit is masked, it is
diff --git a/man/systemd-escape.xml b/man/systemd-escape.xml
index dbb3869a24..5e95e22536 100644
--- a/man/systemd-escape.xml
+++ b/man/systemd-escape.xml
@@ -97,7 +97,7 @@
<listitem><para>Inserts the escaped strings in a unit name
template. Takes a unit name template such as
- <filename>foobar@.service</filename> May not be used in
+ <filename>foobar@.service</filename>. May not be used in
conjunction with <option>--suffix=</option>,
<option>--unescape</option> or
<option>--mangle</option>.</para></listitem>
@@ -108,9 +108,10 @@
<term><option>-p</option></term>
<listitem><para>When escaping or unescaping a string, assume
- it refers to a file system path. This enables special
- processing of the initial <literal>/</literal> of the
- path.</para></listitem>
+ it refers to a file system path. This eliminates leading,
+ trailing or duplicate <literal>/</literal> characters
+ and rejects <literal>.</literal> and <literal>..</literal>
+ path components.</para></listitem>
</varlistentry>
<varlistentry>
@@ -143,7 +144,7 @@
<refsect1>
<title>Examples</title>
- <para>Escape a single string:</para>
+ <para>To escape a single string:</para>
<programlisting>$ systemd-escape 'Hallöchen, Meister'
Hall\xc3\xb6chen\x2c\x20Meister</programlisting>
@@ -155,7 +156,7 @@ Hallöchen, Meister</programlisting>
<programlisting>$ systemd-escape -p --suffix=mount "/tmp//waldi/foobar/"
tmp-waldi-foobar.mount</programlisting>
- <para>To generate instance names of three strings</para>
+ <para>To generate instance names of three strings:</para>
<programlisting>$ systemd-escape --template=systemd-nspawn@.service 'My Container 1' 'containerb' 'container/III'
systemd-nspawn@My\x20Container\x201.service systemd-nspawn@containerb.service systemd-nspawn@container-III.service</programlisting>
</refsect1>
diff --git a/man/systemd-machine-id-setup.xml b/man/systemd-machine-id-setup.xml
index 749987a937..944e899bd4 100644
--- a/man/systemd-machine-id-setup.xml
+++ b/man/systemd-machine-id-setup.xml
@@ -82,7 +82,7 @@
<filename>/etc/machine-id</filename>.</para></listitem>
<listitem><para>If run inside a KVM virtual machine and a UUID
- is was configured (via the <option>-uuid</option>
+ is configured (via the <option>-uuid</option>
option), this UUID is used to initialize the machine ID. The
caller must ensure that the UUID passed is sufficiently unique
and is different for every booted instance of the
@@ -154,7 +154,7 @@
<varlistentry>
<term><option>--print</option></term>
- <listitem><para>Print the machine ID generated or commited after the operation is complete.</para></listitem>
+ <listitem><para>Print the machine ID generated or committed after the operation is complete.</para></listitem>
</varlistentry>
<xi:include href="standard-options.xml" xpointer="help" />
diff --git a/man/systemd-socket-activate.xml b/man/systemd-socket-activate.xml
index 2cf3a7d377..1c0619a840 100644
--- a/man/systemd-socket-activate.xml
+++ b/man/systemd-socket-activate.xml
@@ -142,7 +142,7 @@
<varname>FileDescriptorName=</varname> in socket unit files, and enables use of
<citerefentry><refentrytitle>sd_listen_fds_with_names</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
Multiple entries may be specifies using separate options or by separating names with colons
- (<literal>:</literal>) in one option. In case more names are given than descriptors, superfluous ones willl be
+ (<literal>:</literal>) in one option. In case more names are given than descriptors, superfluous ones will be
ignored. In case less names are given than descriptors, the remaining file descriptors will be unnamed.
</para></listitem>
</varlistentry>
diff --git a/man/systemd-system.conf.xml b/man/systemd-system.conf.xml
index 80cad7f09c..e4e81f7f2e 100644
--- a/man/systemd-system.conf.xml
+++ b/man/systemd-system.conf.xml
@@ -330,7 +330,7 @@
<varname>TasksAccounting=</varname>. See
<citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details on the per-unit
- settings. <varname>DefaulTasksAccounting=</varname> defaults
+ settings. <varname>DefaultTasksAccounting=</varname> defaults
to on, the other three settings to off.</para></listitem>
</varlistentry>
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 54ec7e29ca..3c350df11f 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -1090,7 +1090,7 @@
mechanism. Almost no services need to write to these at runtime; it is hence recommended to turn this on for
most services. For this setting the same restrictions regarding mount propagation and privileges apply as for
<varname>ReadOnlyPaths=</varname> and related calls, see above. Defaults to off.
- Note that this option does not prevent kernel tuning through IPC interfaces and exeternal programs. However
+ Note that this option does not prevent kernel tuning through IPC interfaces and external programs. However
<varname>InaccessiblePaths=</varname> can be used to make some IPC file system objects
inaccessible.</para></listitem>
</varlistentry>
@@ -1255,30 +1255,28 @@
<varlistentry>
<term><varname>SystemCallFilter=</varname></term>
- <listitem><para>Takes a space-separated list of system call
- names. If this setting is used, all system calls executed by
- the unit processes except for the listed ones will result in
- immediate process termination with the
- <constant>SIGSYS</constant> signal (whitelisting). If the
- first character of the list is <literal>~</literal>, the
- effect is inverted: only the listed system calls will result
- in immediate process termination (blacklisting). If running in
- user mode, or in system mode, but without the
- <constant>CAP_SYS_ADMIN</constant> capability (e.g. setting
- <varname>User=nobody</varname>),
- <varname>NoNewPrivileges=yes</varname> is implied. This
- feature makes use of the Secure Computing Mode 2 interfaces of
- the kernel ('seccomp filtering') and is useful for enforcing a
- minimal sandboxing environment. Note that the
- <function>execve</function>,
- <function>rt_sigreturn</function>,
- <function>sigreturn</function>,
- <function>exit_group</function>, <function>exit</function>
- system calls are implicitly whitelisted and do not need to be
- listed explicitly. This option may be specified more than once,
- in which case the filter masks are merged. If the empty string
- is assigned, the filter is reset, all prior assignments will
- have no effect. This does not affect commands prefixed with <literal>+</literal>.</para>
+ <listitem><para>Takes a space-separated list of system call names. If this setting is used, all system calls
+ executed by the unit processes except for the listed ones will result in immediate process termination with the
+ <constant>SIGSYS</constant> signal (whitelisting). If the first character of the list is <literal>~</literal>,
+ the effect is inverted: only the listed system calls will result in immediate process termination
+ (blacklisting). If running in user mode, or in system mode, but without the <constant>CAP_SYS_ADMIN</constant>
+ capability (e.g. setting <varname>User=nobody</varname>), <varname>NoNewPrivileges=yes</varname> is
+ implied. This feature makes use of the Secure Computing Mode 2 interfaces of the kernel ('seccomp filtering')
+ and is useful for enforcing a minimal sandboxing environment. Note that the <function>execve</function>,
+ <function>exit</function>, <function>exit_group</function>, <function>getrlimit</function>,
+ <function>rt_sigreturn</function>, <function>sigreturn</function> system calls and the system calls for
+ querying time and sleeping are implicitly whitelisted and do not need to be listed explicitly. This option may
+ be specified more than once, in which case the filter masks are merged. If the empty string is assigned, the
+ filter is reset, all prior assignments will have no effect. This does not affect commands prefixed with
+ <literal>+</literal>.</para>
+
+ <para>Note that strict system call filters may impact execution and error handling code paths of the service
+ invocation. Specifically, access to the <function>execve</function> system call is required for the execution
+ of the service binary — if it is blocked service invocation will necessarily fail. Also, if execution of the
+ service binary fails for some reason (for example: missing service executable), the error handling logic might
+ require access to an additional set of system calls in order to process and log this failure correctly. It
+ might be necessary to temporarily disable system call filters in order to simplify debugging of such
+ failures.</para>
<para>If you specify both types of this option (i.e.
whitelisting and blacklisting), the first encountered will
@@ -1312,6 +1310,10 @@
</thead>
<tbody>
<row>
+ <entry>@basic-io</entry>
+ <entry>System calls for basic I/O: reading, writing, seeking, file descriptor duplication and closing (<citerefentry project='man-pages'><refentrytitle>read</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>write</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)</entry>
+ </row>
+ <row>
<entry>@clock</entry>
<entry>System calls for changing the system clock (<citerefentry project='man-pages'><refentrytitle>adjtimex</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>settimeofday</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)</entry>
</row>
@@ -1329,7 +1331,7 @@
</row>
<row>
<entry>@ipc</entry>
- <entry>SysV IPC, POSIX Message Queues or other IPC (<citerefentry project='man-pages'><refentrytitle>mq_overview</refentrytitle><manvolnum>7</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>svipc</refentrytitle><manvolnum>7</manvolnum></citerefentry>)</entry>
+ <entry>Pipes, SysV IPC, POSIX Message Queues and other IPC (<citerefentry project='man-pages'><refentrytitle>mq_overview</refentrytitle><manvolnum>7</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>svipc</refentrytitle><manvolnum>7</manvolnum></citerefentry>)</entry>
</row>
<row>
<entry>@keyring</entry>
@@ -1357,17 +1359,21 @@
</row>
<row>
<entry>@process</entry>
- <entry>Process control, execution, namespaces (<citerefentry project='man-pages'><refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>kill</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>namespaces</refentrytitle><manvolnum>7</manvolnum></citerefentry>, …</entry>
+ <entry>Process control, execution, namespaces (<citerefentry project='man-pages'><refentrytitle>clone</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>kill</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>namespaces</refentrytitle><manvolnum>7</manvolnum></citerefentry>, …</entry>
</row>
<row>
<entry>@raw-io</entry>
- <entry>Raw I/O port access (<citerefentry project='man-pages'><refentrytitle>ioperm</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>iopl</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <function>pciconfig_read()</function>, …</entry>
+ <entry>Raw I/O port access (<citerefentry project='man-pages'><refentrytitle>ioperm</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>iopl</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <function>pciconfig_read()</function>, …)</entry>
+ </row>
+ <row>
+ <entry>@resources</entry>
+ <entry>System calls for changing resource limits, memory and scheduling parameters (<citerefentry project='man-pages'><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>, <citerefentry project='man-pages'><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)</entry>
</row>
</tbody>
</tgroup>
</table>
- Note, that as new system calls are added to the kernel, additional system calls might be added to the groups
+ Note that as new system calls are added to the kernel, additional system calls might be added to the groups
above, so the contents of the sets may change between systemd versions.</para>
<para>It is recommended to combine the file system namespacing related options with
@@ -1396,28 +1402,25 @@
<varlistentry>
<term><varname>SystemCallArchitectures=</varname></term>
- <listitem><para>Takes a space-separated list of architecture
- identifiers to include in the system call filter. The known
- architecture identifiers are <constant>x86</constant>,
- <constant>x86-64</constant>, <constant>x32</constant>,
- <constant>arm</constant>, <constant>s390</constant>,
- <constant>s390x</constant> as well as the special identifier
- <constant>native</constant>. Only system calls of the
- specified architectures will be permitted to processes of this
- unit. This is an effective way to disable compatibility with
- non-native architectures for processes, for example to
- prohibit execution of 32-bit x86 binaries on 64-bit x86-64
- systems. The special <constant>native</constant> identifier
- implicitly maps to the native architecture of the system (or
- more strictly: to the architecture the system manager is
- compiled for). If running in user mode, or in system mode,
- but without the <constant>CAP_SYS_ADMIN</constant>
- capability (e.g. setting <varname>User=nobody</varname>),
- <varname>NoNewPrivileges=yes</varname> is implied. Note
- that setting this option to a non-empty list implies that
- <constant>native</constant> is included too. By default, this
- option is set to the empty list, i.e. no architecture system
- call filtering is applied.</para></listitem>
+ <listitem><para>Takes a space-separated list of architecture identifiers to
+ include in the system call filter. The known architecture identifiers are the same
+ as for <varname>ConditionArchitecture=</varname> described in
+ <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+ as well as <constant>x32</constant>, <constant>mips64-n32</constant>,
+ <constant>mips64-le-n32</constant>, and the special identifier
+ <constant>native</constant>. Only system calls of the specified architectures will
+ be permitted to processes of this unit. This is an effective way to disable
+ compatibility with non-native architectures for processes, for example to prohibit
+ execution of 32-bit x86 binaries on 64-bit x86-64 systems. The special
+ <constant>native</constant> identifier implicitly maps to the native architecture
+ of the system (or more strictly: to the architecture the system manager is
+ compiled for). If running in user mode, or in system mode, but without the
+ <constant>CAP_SYS_ADMIN</constant> capability (e.g. setting
+ <varname>User=nobody</varname>), <varname>NoNewPrivileges=yes</varname> is
+ implied. Note that setting this option to a non-empty list implies that
+ <constant>native</constant> is included too. By default, this option is set to the
+ empty list, i.e. no architecture system call filtering is applied.
+ </para></listitem>
</varlistentry>
<varlistentry>
@@ -1464,7 +1467,7 @@
<listitem><para>Takes a boolean argument. If true, explicit module loading will
be denied. This allows to turn off module load and unload operations on modular
- kernels. It is recomended to turn this on for most services that do not need special
+ kernels. It is recommended to turn this on for most services that do not need special
file systems or extra kernel modules to work. Default to off. Enabling this option
removes <constant>CAP_SYS_MODULE</constant> from the capability bounding set for
the unit, and installs a system call filter to block module system calls,
diff --git a/man/systemd.offline-updates.xml b/man/systemd.offline-updates.xml
index f404c8d72f..07a5225512 100644
--- a/man/systemd.offline-updates.xml
+++ b/man/systemd.offline-updates.xml
@@ -143,7 +143,7 @@
<varname>FailureAction=</varname> makes sure that the specified unit is activated if your
script exits uncleanly (by non-zero error code, or signal/coredump). If your script succeeds
you should trigger the reboot in your own code, for example by invoking logind's
- <command>Reboot()</command> call or calling <command>systemct reboot</command>. See
+ <command>Reboot()</command> call or calling <command>systemctl reboot</command>. See
<ulink url="http://www.freedesktop.org/wiki/Software/systemd/logind">logind dbus API</ulink>
for details.</para>
</listitem>
diff --git a/man/systemd.target.xml b/man/systemd.target.xml
index 2e35e54fc4..b3cccd4e52 100644
--- a/man/systemd.target.xml
+++ b/man/systemd.target.xml
@@ -83,7 +83,7 @@
<title>Automatic Dependencies</title>
<para>Unless <varname>DefaultDependencies=</varname> is set to
- <option>no</option> in either of releated units or an explicit ordering
+ <option>no</option> in either of related units or an explicit ordering
dependency is already defined, target units will implicitly complement all
configured dependencies of type <varname>Wants=</varname> or
<varname>Requires=</varname> with dependencies of type
diff --git a/man/tmpfiles.d.xml b/man/tmpfiles.d.xml
index 75fb901102..e040a1636d 100644
--- a/man/tmpfiles.d.xml
+++ b/man/tmpfiles.d.xml
@@ -644,7 +644,7 @@ d /run/uscreens 0755 root screen 10d12h
t /run/cups - - - - security.SMACK64=printing user.attr-with-spaces="foo bar"
</programlisting>
- <para>The direcory will be owned by root and have default mode. It's contents are
+ <para>The directory will be owned by root and have default mode. Its contents are
not subject to time based cleanup, but will be obliterated when
<command>systemd-tmpfiles --remove</command> runs.</para>
</example>
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-03 15:23:59 +0000